           [plumbing-service authorization-service]
           (assoc-in minimal-config [:authorization :rules] rules-w-exts)
           (testing "allowed request via extensions"
-            (let [req (request "/puppet/v4/catalog" :get "127.0.0.1" allowable-cert)]
+            (let [req (testutils/request "/puppet/v4/catalog" :get "127.0.0.1" allowable-cert)]
               (is (-> (get-service app :PlumbingService)
                       (call-authorization-check req {:oid-map oid-map})
                       rules/authorized?))))
           (testing "denied request via extensions"
-            (let [req (request "/puppet/v4/catalog" :get "127.0.0.1" deniable-cert)]
+            (let [req (testutils/request "/puppet/v4/catalog" :get "127.0.0.1" deniable-cert)]
               (is (not (-> (get-service app :PlumbingService)
                            (call-authorization-check req {:oid-map oid-map})
                            rules/authorized?)))))

                       "denied by rule 'puppetlabs catalog'.")))))
  (testing "Evaluation against rule with 'method' restrictions"
    (let [app (build-ring-handler default-rules)]
      (let [req (request "/puppet-ca/v1/certificate_request/ca"
                         :head "127.0.0.1" test-domain-cert)
            {:keys [status body]} (app req)]
        (is (= status 403))
        (is (= body "global deny all - no rules matched")))
      (let [req (request "/puppet-ca/v1/certificate_request/ca"
                         :get "127.0.0.1" test-domain-cert)
            {:keys [status]} (app req)]
        (is (= status 200)))
      (let [req (request "/puppet-ca/v1/certificate_request/ca"
                         :put "127.0.0.1" test-domain-cert)
            {:keys [status]} (app req)]
        (is (= status 200))))))


                  (update-in [:headers] merge
                             {"x-client-dn" "CN=test.domain.org"
                              "x-client-verify" "SUCCESS"
                              "x-client-cert" (testutils/url-encoded-cert
                                                testutils/test-domain-cert)}))
          response (app req)
          authorization (get-in response [:request :authorization])]
      (is (= 200 (:status response)))
